funman300
9aecc658ad
The FUT store flashes a Browse-Packs overview on first open: the store screen ctor leaves screen+0x290 (CATEGORY_ID) at 0, and the resolver FUN_1800147f0 treats 0 as list-all, so the first render draws the group overview before the movie posts a tab ordinal. Detour the store render FUN_18007dab0 (RVA 0x7dab0): when the incoming category is 0, substitute the first present group ordinal (1) so the first frame lands on a real tab. Provably crash-safe: it writes 1 only after FUN_180014420(_, 1) (the resolver's own ordinal->group lookup, whose first arg is dead) returns non-NULL, which is exactly the resolver's non-crash precondition; the positive-invalid NULL deref at 0x14882 is thus unreachable. No group yet -> category left 0 -> Browse, still safe. Promoted like the SBC dispatch: build-armed (CLAMP_PROMOTED), no env. Signature-gated on both the detoured render and the called lookup, image-validated, installed under thread suspension, fail-closed. Only the overview flash is addressed; the empty-My-Packs entry dialog is movie-side (packed .apt) and out of CardsDLL reach (see Vault Store Resolver Guard 2026-08-19). fmt/clippy -D warnings clean both feature sets, 26 hook tests pass, x86_64-pc-windows-gnu release builds.